Everybody loves m-commerce. Customers can shop whenever it's convenient for them. Merchants earn more sales because customers have their store in their pocket or bag. And fraudsters see a bonanza because mobile fraud prevention practices haven't yet caught up to the many ways criminals can exploit the channel. That's part of the reason that 72% of fraudulent transactions happened via mobile during the first three months of 2019.
\r\nFraud in the mobile channel is a serious risk to merchants and consumers. Stopping it requires a multipronged approach that's slightly different from traditional e-commerce fraud prevention.
\r\nHere's what you need to know to protect your mobile channel from three common types of fraud.
\r\nBrand impersonation is a growing problem on all kinds of platforms, including email, SMS, social media and mobile apps. Malicious brand impersonation accounts on social media have increased elevenfold since 2014, as fraudsters seek to dupe consumers into sharing payment data and credentials. Digital security firm RSA said that social brand impersonation accounted for 9% of all Q1 2019 online fraud.
\r\nThere are two ways brand impersonators directly exploit the mobile channel to target victims and steal data. The first is by using technologies that are unique to mobile: SMS and apps.
\r\nIn a typical SMS brand impersonation attack, fraudsters send a message asking recipients to click on a link to verify account information, claim a prize or change their password. The link may look legitimate, but it leads victims to a site that harvests their data for resale on the dark web or for use by the scammers who sent the text messages.
\r\nIn an app impersonation scam, malicious actors publish apps that appear to be from trusted retailers or service providers. Customers who don't realize the apps are fake may install them, putting themselves at risk for credential theft, card fraud and malware injections on their mobile devices. RSA found that so-called rogue mobile apps made up half of all fraud attacks in Q1 2019, a 300% increase from the previous quarter.
\r\nFraudsters take advantage of mobile users indirectly, too. Phishing email campaigns are sometimes timed to coincide with commuter hours, which makes it more likely that victims will read the message on their phone. This matters to criminals because most mobile email clients don't display the sender's email address, only their name – which the fraudsters can set up to be anyone or any brand. Without the address visible to verify the sender's identity, mobile recipients are up to three times more likely to fall for the scam than they would be if they were at their desktop.
\r\nPreventing brand impersonation requires ongoing vigilance. To push back against social media scammers impersonating your brand, you need to
\r\nRoutinely check the major app platforms for apps that might be posing as your brand and report them to the platform when you find them.
\r\nTo keep fraudsters from impersonating your brand via email and SMS, let your customers know how to check that messages are from your company, and let them know that you'll never ask for payment or login data by email or text. Consider hiring a digital security service to monitor the web for domains impersonating your brand. Hosting services usually shut down these domains if there's evidence they're violating trademarks or engaging in scam behavior.
\r\nCard-not-present (CNP) fraud has been steadily rising for years, as point-of-sale card fraud has become more difficult due to EMV adoption. According to the Verizon 2019 Data Breach Investigations Report, CNP fraud now accounts for nearly 75% of all card-related fraud.
\r\nAite Group projects that CNP fraud will increase by 16.4% by 2021, costing merchants $6.4 billion. Meanwhile, when merchants deploy fully automated solutions to prevent CNP fraud, their false decline rates may also go up. Aite found that 62% of the merchants they surveyed have had higher rates of false declines since 2017 – a problem that causes merchants to lose sales and customers.
\r\nAlthough CNP fraud is a problem in both mobile and online channels, each channel requires different fraud-prevention strategies. For example, the behavioral biometrics that can be evaluated on a mobile device are different from those on a desktop. How many apps are installed on the phone? What's the current geolocation data? How is the current user holding their phone? How do these markers compare to the customer's past biometric data? Adding mobile-specific layers of authentication to your store's fraud prevention program can better protect you from CNP fraud.
\r\nTracking CNP fraud metrics by channel is important, too. Ideally, every merchant would track completed and prevented fraud in each channel, but many don't. Tracking by channel shows you which channel is more heavily attacked, which is better at stopping fraud and pinpointing where you need to focus your fraud prevention resources.
\r\nMobile account takeover is another fraud-related problem that's becoming more common. Mobile phone account takeovers increased by 56% from 2017 to 2018, according to Javelin Research. That's because SIM swap fraud has become a relatively cheap and easy way to remotely hijack victims' phones. And with control of a phone, criminals have access to the authentication channels they need to take over most, if not all, of the victim's online accounts.
\r\nThis type of account takeover made news recently when Twitter founder Jack Dorsey's account was hacked via a SIM swap that targeted his phone. Criminals don't need physical access to the phone to run this scheme. They only need the phone number and the ability to persuade or bribe the cell carrier's customer service personnel to virtually change the SIM number associated with the account to one the criminals control. Then, two-factor authentication codes sent via SMS or voice call go straight to the hackers, which means they can reset their passwords for email, banking, and social media accounts, as well as retail apps and customer accounts.
\r\nSIM swaps aren't the only way fraudsters gain control of consumers' accounts. Millions of credentials have been stolen in data breaches and offered for sale on the dark web. Even without the passwords for those accounts, account takeover (ATO) scammers can use botnets to brute force crack passwords if they have the login ID. And because so few people use a unique password for every account, when one password is cracked, it's usually easy to access that victim's other accounts.
\r\nHow can your store reduce its risk of ATO fraud while keeping good customers happy?
\r\nDespite the fraud risks, mobile holds tremendous potential for online merchants. It's already the leading e-commerce channel in many countries, and it accounted for nearly one-third of U.S. online retail sales at the end of 2018.
\r\nThe challenge for merchants is to build mobile sales channels that are as secure from fraud as possible and easy for good customers to use.
\r\nTo achieve those goals, online retailers need to focus now on guarding against mobile brand impersonation, CNP fraud and account takeover fraud.
\n","docType":"article","guid":"articles_76acb9c85b9ea0de9b694d639a76061c","lastModified":"2019-10-16T14:00:00.000Z","published":"2019-10-16T14:00:00.000Z","structuredData":null,"subtitle":"For brands to succeed in the mobile channel, they must provide a secure shopping experience for customers.","template":"v1","title":"How Safe Is Your Online Store's Mobile Channel From These Types of Fraud?","type":"article","author":{"avatar":null,"bio":"Rafael Lourenco is Executive Vice President at ClearSale, a Card-Not-Present fraud prevention operation that protects e-commerce merchants against chargebacks. The company’s flagship product, Total Guaranteed Protection, is an end-to-end outsourced fraud detection solution for online retailers. Follow on twitter at @ClearSaleUS or visit http://clear.sale/.","name":"Rafael Lourenco","image":null,"slug":null,"social":{"facebook":"","linkedin":"https://www.linkedin.com/in/rafael-lourenco-5a71b823/","twitter":"https://twitter.com/clearsaleus","website":"https://www.clear.sale/"},"status":"enabled","title":null,"type":"New BDC Member","user":{"imagePath":"https://staging.business.com/images/uploads/user/profile/9dac2af9242e2349bf049cf1bf75c63ae00f1.jpg","profile":{"company":"ClearSale","jobTitle":"EVP","website":"https://www.clear.sale/"}}},"breadcrumbs":null,"channels":{"primary":{"name":"Business Basics","slug":"business-basics"},"sub":{"name":"Strategy","slug":"strategy"}},"meta":{"robots":"index, follow","description":"As an online retailer, learn what steps to take today to guard against mobile brand impersonation, CNP fraud and account takeover fraud.","title":"How to Protect Your Company from Mobile Channel Fraud - business.com"},"parsedContent":{"toc":[{"id":"stopping-mobile-brand-impersonation","title":"Stopping mobile brand impersonation"},{"id":"fighting-card-not-present-fraud-in-the-mobile-channel","title":"Fighting card-not-present fraud in the mobile channel"},{"id":"preventing-and-identifying-account-takeover-fraud-in-m-commerce","title":"Preventing and identifying account takeover fraud in m-commerce"}],"json":[{"component":"p","children":["Everybody loves m-commerce. Customers can shop whenever it's convenient for them. Merchants earn more sales because customers have their store in their pocket or bag. And fraudsters see a bonanza because mobile fraud prevention practices haven't yet caught up to the many ways criminals can exploit the channel. That's part of the reason that ",{"component":"a","props":{"href":"https://www.rsa.com/en-us/offers/rsa-fraud-report-q1-2019","target":"_blank","rel":"nofollow"},"children":["72% of fraudulent transactions happened via mobile"]}," during the first three months of 2019."]},{"component":"p","children":["Fraud in the mobile channel is a serious risk to merchants and consumers. Stopping it requires a multipronged approach that's slightly different from traditional e-commerce fraud prevention."]},{"component":"p","children":["Here's what you need to know to protect your mobile channel from three common types of fraud."]},{"component":"h2","props":{"id":"stopping-mobile-brand-impersonation"},"children":["Stopping mobile brand impersonation"]},{"component":"p","children":["Brand impersonation is a growing problem on all kinds of platforms, including email, SMS, social media and mobile apps. Malicious ",{"component":"a","props":{"href":"https://www.adweek.com/brand-marketing/how-to-protect-your-brand-from-malicious-brand-impersonations/","target":"_blank","rel":"nofollow"},"children":["brand impersonation accounts on social media"]}," have increased elevenfold since 2014, as fraudsters seek to dupe consumers into sharing payment data and credentials. Digital security firm RSA said that social brand impersonation accounted for 9% of all Q1 2019 online fraud. "]},{"component":"p","children":["There are two ways brand impersonators directly exploit the mobile channel to target victims and steal data. The first is by using technologies that are unique to mobile: SMS and apps. "]},{"component":"p","children":["In a typical ",{"component":"a","props":{"href":"https://www.abc.net.au/news/science/2019-03-01/qantas-apple-sms-scams-are-embarrassingly-easy/10854854","target":"_blank","rel":"nofollow"},"children":["SMS brand impersonation attack"]},", fraudsters send a message asking recipients to click on a link to verify account information, claim a prize or change their password. The link may look legitimate, but it leads victims to a site that harvests their data for resale on the dark web or for use by the scammers who sent the text messages. "]},{"component":"p","children":["In an ",{"component":"a","props":{"href":"https://resources.digitalshadows.com/online-brand-security/mobile-application-detected-impersonating-company-brand","target":"_blank","rel":"nofollow"},"children":["app impersonation"]}," scam, malicious actors publish apps that appear to be from trusted retailers or service providers. Customers who don't realize the apps are fake may install them, putting themselves at risk for credential theft, card fraud and malware injections on their mobile devices. RSA found that so-called rogue mobile apps made up half of all fraud attacks in Q1 2019, a 300% increase from the previous quarter."]},{"component":"p","children":["Fraudsters take advantage of mobile users indirectly, too. Phishing email campaigns are sometimes timed to coincide with commuter hours, which makes it more likely that victims will read the message on their phone. This matters to criminals because most mobile email clients don't display the sender's email address, only their name – which the fraudsters can set up to be anyone or any brand. Without the address visible to verify the sender's identity, mobile recipients are ",{"component":"a","props":{"href":"https://blog.malwarebytes.com/101/2018/12/something-else-phishy-detect-phishing-attempts-mobile/","target":"_blank","rel":"nofollow"},"children":["up to three times more likely to fall for the scam"]}," than they would be if they were at their desktop."]},{"component":"p","children":["Preventing brand impersonation requires ongoing vigilance. To push back against ",{"component":"a","props":{"href":"https://blog.redpoints.com/en/guide-to-brand-protection-on-social-media","target":"_blank","rel":"nofollow"},"children":["social media scammers impersonating your brand"]},", you need to "]},{"component":"ul","children":[{"component":"li","children":["Monitor social channels for trademark infringement."]},{"component":"li","children":["Report fake accounts with each platform's reporting tools."]},{"component":"li","children":["Establish active, validated accounts for your brand on major social platforms. "]}]},{"component":"p","children":["Routinely check the major app platforms for apps that might be posing as your brand and report them to the platform when you find them. "]},{"component":"p","children":["To keep fraudsters from impersonating your brand via email and SMS, let your customers know how to check that messages are from your company, and let them know that you'll never ask for payment or login data by email or text. Consider hiring a digital security service to monitor the web for domains impersonating your brand. Hosting services usually shut down these domains if there's evidence they're violating trademarks or engaging in scam behavior."]},{"component":"h2","props":{"id":"fighting-card-not-present-fraud-in-the-mobile-channel"},"children":["Fighting card-not-present fraud in the mobile channel"]},{"component":"p","children":["Card-not-present (CNP) fraud has been steadily rising for years, as point-of-sale card fraud has become more difficult due to EMV adoption. According to the ",{"component":"a","props":{"href":"https://www.verizondigitalmedia.com/blog/2019-verizon-data-breach-investigations-report-first-impressions/","target":"_blank","rel":"nofollow"},"children":["Verizon 2019 Data Breach Investigations Report"]},", CNP fraud now accounts for nearly 75% of all card-related fraud. "]},{"component":"p","children":["Aite Group projects that CNP fraud will increase by 16.4% by 2021, costing merchants $6.4 billion. Meanwhile, when merchants deploy fully automated solutions to prevent CNP fraud, their false decline rates may also go up. Aite found that 62% of the merchants they surveyed have had higher rates of false declines since 2017 – a problem that causes merchants to lose sales and customers. "]},{"component":"p","children":["Although CNP fraud is a problem in both mobile and online channels, each channel requires different fraud-prevention strategies. For example, the behavioral biometrics that can be evaluated on a mobile device are different from those on a desktop. How many apps are installed on the phone? What's the current geolocation data? How is the current user holding their phone? How do these markers compare to the customer's past biometric data? Adding mobile-specific layers of authentication to your store's fraud prevention program can better protect you from CNP fraud."]},{"component":"p","children":["Tracking CNP fraud metrics by channel is important, too. Ideally, every merchant would track completed and prevented fraud in each channel, but many don't. Tracking by channel shows you which channel is more heavily attacked, which is better at stopping fraud and pinpointing where you need to focus your fraud prevention resources."]},{"component":"h2","props":{"id":"preventing-and-identifying-account-takeover-fraud-in-m-commerce"},"children":["Preventing and identifying account takeover fraud in m-commerce"]},{"component":"p","children":["Mobile account takeover is another fraud-related problem that's becoming more common. Mobile phone account takeovers increased by 56% from 2017 to 2018, according to Javelin Research. That's because SIM swap fraud has become a relatively cheap and easy way to remotely hijack victims' phones. And with control of a phone, criminals have access to the authentication channels they need to take over most, if not all, of the victim's online accounts. "]},{"component":"p","children":["This type of account takeover made news recently when Twitter founder ",{"component":"a","props":{"href":"https://www.nytimes.com/2019/09/05/technology/sim-swap-jack-dorsey-hack.html","target":"_blank","rel":"nofollow"},"children":["Jack Dorsey's account was hacked via a SIM swap"]}," that targeted his phone. Criminals don't need physical access to the phone to run this scheme. They only need the phone number and the ability to persuade or bribe the cell carrier's customer service personnel to virtually change the SIM number associated with the account to one the criminals control. Then, two-factor authentication codes sent via SMS or voice call go straight to the hackers, which means they can reset their passwords for email, banking, and social media accounts, as well as retail apps and customer accounts."]},{"component":"p","children":["SIM swaps aren't the only way fraudsters gain control of consumers' accounts. Millions of credentials have been stolen in data breaches and offered for sale on the dark web. Even without the passwords for those accounts, account takeover (ATO) scammers can use botnets to brute force crack passwords if they have the login ID. And because so few people use a unique password for every account, when one password is cracked, it's usually easy to access that victim's other accounts. "]},{"component":"p","children":["How can your store reduce its risk of ATO fraud while keeping good customers happy? "]},{"component":"ul","children":[{"component":"li","children":["Require customers to choose strong passwords for their store accounts, and encourage them to choose passwords they don't use for other accounts. "]},{"component":"li","children":["Encourage customers to opt in to receive alerts whenever their password is changed, or when they make purchases over a set spending limit. "]},{"component":"li","children":["Offer two-factor authentication for your customer accounts. It's not foolproof, as SIM swap ATOs show, but it offers some protection. Keep in mind that two-factor authentication adds some friction to checkout, which can cause conversion rates to drop. If you go this route, monitor your conversion metrics carefully and be ready to make adjustments to find the right balance."]},{"component":"li","children":["Build a fraud-prevention program comprising multiple layers of identity and device verification plus other screening parameters that are tailored to each sales channel's fraud risk profile. "]},{"component":"li","children":["Manually review all flagged orders instead of automatically rejecting them. This can reduce false declines and help identify accounts that have been taken over. Entering the results of these manual reviews can also improve the accuracy of your fraud-detection algorithm."]}]},{"component":"p","children":["Despite the fraud risks, mobile holds tremendous potential for online merchants. It's already the leading e-commerce channel in many countries, and it accounted for nearly one-third of U.S. online retail sales at the end of 2018."]},{"component":"p","children":["The challenge for merchants is to build mobile sales channels that are as secure from fraud as possible and easy for good customers to use."]},{"component":"p","children":["To achieve those goals, online retailers need to focus now on guarding against mobile brand impersonation, CNP fraud and account takeover fraud."]}]},"resource":null,"sponsorship":null,"thumbnail":{"path":"https://staging.business.com/images/content/5da/4c35d9c658a29558b456b/1500-0-","caption":"Ivan-balvan/Getty Images","isBlurred":false},"bestPicks":null},"related":{"relatedArticles":[{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay - 08-05","canonical":"https://staging.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://staging.business.com/images/content/5c5/afd7f54d26d67178b458d/1500-0-","dek":"Edit 07-24 - subtitle","lastModified":"2019-08-05T20:58:00Z","published":"2018-06-21T16:05:00Z","sponsored":null},{"title":"Retail Technology Guide","canonical":"https://www.business.com/articles/retail-technology-guide/","slug":"retail-technology-guide","thumbnail":"https://www.business.com/images/content/591/c92fd1039eb40168b4567/1500-0-","dek":"How to use today's tech for sales, customer loyalty and brand awareness","lastModified":"2017-06-05T16:00:00Z","published":"2017-06-05T16:00:00Z","sponsored":false},{"title":"Mobile Wallet Guide: Google Pay vs. Apple Pay vs. Samsung Pay","canonical":"https://www.business.com/articles/google-pay-vs-apple-pay-vs-samsung-pay/","slug":"google-pay-vs-apple-pay-vs-samsung-pay","thumbnail":"https://www.business.com/images/content/5c5/e0a269c658a457c8b4591/1500-0-","dek":"You no longer need to carry a bulky wallet filled with numerous credit cards or cash.","lastModified":"2018-06-21T16:06:00Z","published":"2018-06-21T16:05:00Z","sponsored":false},{"title":"Hiring for Retail: A Guide to Building the Right Team","canonical":"https://www.business.com/articles/retail-hiring-guide/","slug":"retail-hiring-guide","thumbnail":"https://www.business.com/images/content/594/85c791039eb45268b4572/1500-0-","dek":"It starts with the interview and ends with you.","lastModified":"2017-07-12T07:00:00Z","published":"2017-07-12T07:00:00Z","sponsored":false},{"title":"5 Preventable Human Errors That Leave Your Company Vulnerable to a Cyberattack","canonical":"https://www.business.com/articles/preventable-human-errors/","slug":"preventable-human-errors","thumbnail":"https://www.business.com/images/content/5b0/306f192a3a4090f8b4577/1500-0-","dek":"Most cyberattacks stem from internal human error, but companies can protect themselves.","lastModified":"2018-05-21T07:00:00Z","published":"2018-05-21T07:00:00Z","sponsored":false},{"title":"The Ultimate Small Business Guide to Credit Card Processing Fees","canonical":"https://www.business.com/articles/credit-card-processing-fees/","slug":"credit-card-processing-fees","thumbnail":"https://www.business.com/images/content/5d2/346547b437454698b4577/1500-0-","dek":"Learn about credit card processing fees and how to negotiate for lower costs.","lastModified":"2020-06-16T10:08:00Z","published":"2017-12-07T08:00:00Z","sponsored":false},{"title":"Ready to Franchise Your Retail Business? Here's How","canonical":"https://www.business.com/articles/retail-franchise-guide/","slug":"retail-franchise-guide","thumbnail":"https://www.business.com/images/content/590/a70d83087b15807b6063c/1500-0-","dek":"Is your business a good fit for a franchise?","lastModified":"2017-06-15T07:00:00Z","published":"2017-06-15T07:00:00Z","sponsored":false},{"title":"Has Your Company Secured These Overlooked Attack Vectors?","canonical":"https://www.business.com/articles/3-overlooked-attack-vectors/","slug":"3-overlooked-attack-vectors","thumbnail":"https://www.business.com/images/content/5ac/649ee92a3a4d15e8b4582/1500-0-","dek":"Many don't consider these three common security weaknesses.","lastModified":"2018-04-05T07:00:00Z","published":"2018-04-05T07:00:00Z","sponsored":false},{"title":"Considering Going Cashless? Electronic Payment Expert Discusses the Benefits","canonical":"https://www.business.com/articles/electronic-transactions-association-benefits-going-cashless/","slug":"electronic-transactions-association-benefits-going-cashless","thumbnail":"https://www.business.com/images/content/5ba/a86ba1039eb822b8b4579/1500-0-","dek":"Want to increase your customer base? This CEO says offering more payment options is key.","lastModified":"2018-09-25T20:00:00Z","published":"2018-09-25T20:00:00Z","sponsored":false},{"title":"RFID for Retail: Know the Pros and Cons","canonical":"https://www.business.com/articles/rfid-for-retail/","slug":"rfid-for-retail","thumbnail":"https://www.business.com/images/content/592/2ff8e1039eb5e438b4567/1500-0-","dek":"Radio Frequency Identification is more affordable and useful than ever.","lastModified":"2017-06-13T14:00:00Z","published":"2017-06-13T14:00:00Z","sponsored":false},{"title":"Is Retail Ready for AI? What to Expect","canonical":"https://www.business.com/articles/retail-artificial-intelligence/","slug":"retail-artificial-intelligence","thumbnail":"https://www.business.com/images/content/592/4784f1039eb74248b4567/1500-0-","dek":"Artificial intelligence is changing and improving the way retailers do business.","lastModified":"2017-07-19T07:00:00Z","published":"2017-07-19T07:00:00Z","sponsored":false},{"title":"How Crooks Hack Passwords and How You Can Protect Your Business","canonical":"https://www.business.com/articles/how-crooks-hack-passwords/","slug":"how-crooks-hack-passwords","thumbnail":"https://www.business.com/images/content/5a7/2321651ee47ea618b4568/1500-0-","dek":"The use of traditional passwords is a slippery slope for companies these days.","lastModified":"2018-01-31T08:00:00Z","published":"2018-01-31T08:00:00Z","sponsored":false}],"relatedReviews":[{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5df908cc5a215e8c4a8b4568/conferencecall_Antonio_Diaz_Getty.jpg","canonical":"https://staging.business.com/categories/best-conference-call-services/","title":"The Best Conference Call Services of 2021","dek":"Which conference call service is right for your business in 2021? We review the top-rated services.","slug":"best-conference-call-services","lastModified":"2021-03-17T18:17:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5db752e25a215e277d8b4588/Invoicing_AndreyPopov_BDC.png","canonical":"https://staging.business.com/categories/best-collections-agency-services/","title":"The Best Collection Agency Services of 2021","dek":"We've reviewed the best collection agency services for 2021. See up-to-date comparisons on features and the best prices for the top-rated agencies.","slug":"best-collections-agency-services","lastModified":"2021-03-17T16:34:00Z"},{"doc_type":"category","thumbnail":"https://staging.business.com/images/rz/5e4edd837b437442548b456d/cash_Dutko_getty.jpg","canonical":"https://staging.business.com/categories/small-business-loans-and-financing-options/","title":"The Best Business Loan and Financing Options of 2021","dek":"Many small businesses need funding to get started. Learn about the different financing options to decide which would work best for your small business.","slug":"small-business-loans-and-financing-options","lastModified":"2021-03-11T17:24:00Z"}],"relatedSponsoredArticles":null}},"pageContext":{"displayModified":"2019-10-16T14:00:00.000Z","template":"v1","title":"How Safe Is Your Online Store's Mobile Channel From These Types of Fraud?","meta":{"robots":"index, follow"},"docType":"articles","slug":"how-safe-is-your-online-store","canonical":"https://staging.business.com/articles/how-safe-is-your-online-store/","skipTOC":false}},"staticQueryHashes":[]}